CVE-2026-43984

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-04 16:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-43984

Mitre link : CVE-2026-43984

CVE.ORG link : CVE-2026-43984

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-43984", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43984", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T17:04:03.343436Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Tautulli", "product": "Tautulli", "versions": [{"status": "affected", "version": "< 2.17.1"}]}]}], "published": "2026-06-04T16:16:37.883", "references": [{"url": "https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue."}, {"lang": "es", "value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. Las versiones anteriores a la 2.17.1 exponen 'log_js_errors' a cualquier usuario autenticado, incluyendo a los usuarios invitados cuando el acceso de invitado est\u00e1 habilitado. El endpoint escribe cadenas controladas por el atacante directamente en el registro principal de la aplicaci\u00f3n. La vista 'logFile' solo para administradores luego lee ese archivo de registro y lo incrusta en una respuesta HTML sin escapar. Esto crea una condici\u00f3n de cross-site scripting almacenado donde un invitado de bajo privilegio puede inyectar HTML o JavaScript en el archivo de registro y hacer que se ejecute en el navegador de un administrador cuando se abre el visor de registros. La versi\u00f3n 2.17.1 corrige el problema."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "security-advisories@github.com"}